* refactor: resolve oxlint correctness findings without behavior changes
- Snapshot iterations that mutate their collection with Array.from()
instead of a spread (live childNodes, self-removing disposers, a Set
extended inside its own loop).
- Drop empty spread fallbacks, redundant regex escapes, Boolean() casts
inside negations, a rethrow-only try/catch and statement ternaries.
- Use startsWith/endsWith for anchored literal checks in the extension.
- List U+FE0F explicitly in the mobile attachment emoji class; the
matched set is unchanged.
- Fix the WeChat copy fixture, where \oint in a template literal lost its
backslash and the block formula never exercised \oint.
- Document the intentional control-character regexes (filename
sanitizing and input validation), the throwing provider stream test,
Astro's generated type reference and the mobile auto-sync finally
block with narrow inline exceptions.
* ci: run oxlint correctness rules on pull requests
Pin oxlint 1.88.0 and enable only its correctness category across apps/
and packages/, excluding build output, vendored code and the iOS app.
Findings are errors and the script passes --deny-warnings, so CI fails
on any finding. no-unused-vars stays off until unused code is removed
in a dedicated pass.
Official entries stay on the bundled registry. The instance returns a community file only when EDGE_EVER_COMMUNITY_REGISTRY_URL is set, and submission opens from its own marketplace entry.
Assigning globalThis.window = undefined creates an own property. On Ubuntu
that shadows the host window, so later editor tests throw when ProseMirror
reads window.MutationObserver.
Saving a digest switch and its time both register the same desktop schedule. Overlapping requests were dropped, so the task stayed off and the plugin showed a restart notice.
Keep plugin and theme membership on the workspace so browsers and desktop apps can re-download verified packages. Settings, secrets, and native mobile runtimes stay out of this catalog.
Related Issue: #396
Marketplace updates look up the semver tag first, so official plugins
published as vX.Y.Z failed with "GitHub release was not found." Retry
the v-prefixed tag in the instance proxy and the desktop installer.
Marketplace cards keep launcher commands only. The toolbar menu keeps
editor commands and dashboard panels, and drops workflow dialogs plus
commands that only open a dashboard already in the menu.
Read the latest Release through the instance (cached 5 minutes),
then the public latest/download URL and raw.githubusercontent.com.
Do not treat one plugin's 403 as a total update-check failure.
Prefer the GitHub API asset-id route after the public release URL fails, and skip re-downloading official plugin packages when the live version already matches.
Official plugins already update silently in the background. Drop the blocking "got it" notice so a successful auto-update does not steal focus from the workspace.
Official marketplace plugins already show the official auto-update badge, but the first-enable confirmation still used community-plugin copy. Skip that confirmation for publisher EdgeEver plugins; community plugins still get the one-time warning.
Desktop install was failing with Failed to fetch because the renderer
fetched GitHub metadata directly. Resolve live official releases and
download Release assets via the current EdgeEver instance, so daily
plugin updates still work without a client-side GitHub API round trip.
Dariusz Koryto